Add Docker deploy and Gitea Actions CI, plus a local testing guide

Dockerfile/docker-compose.yml mirror keep's pattern — same
better-sqlite3 native-addon build story, same pull_policy: always +
named volume for the SQLite DB so redeploys don't lose captured
articles. Gitea Actions workflow builds and pushes to the Gitea
container registry on push to main (needs a TKNTKN repo secret, same
as keep/wisp/npm-statuspage).

TESTING.md is the step-by-step for running the server + loading the
extension unpacked, written up from what was actually verified
end-to-end in the previous session.

Verified: image builds, server starts and responds inside the
container, capture works, and data survives a container restart.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

TESTING.md

@@ -0,0 +1,55 @@
+# Trying stash locally
+
+## 1. Start the server
+
+```bash
+cd ~/temp/stash
+cp .env.example .env
+npm install
+npm run token -- my-laptop
+```
+
+`npm run token` prints a bearer token — copy it. Then:
+
+```bash
+npm run dev:server
+```
+
+Leave that running (listens on `:3070` by default).
+
+## 2. Load the extension
+
+- Open `chrome://extensions` (or `edge://extensions` — anything Chromium-based)
+- Toggle **Developer mode** on (top right)
+- Click **Load unpacked**, select `~/temp/stash/extension`
+- Click the puzzle-piece icon in the toolbar → pin **stash** so it's visible
+
+## 3. Configure it
+
+- Right-click the stash icon → **Options** (or it'll auto-open the first
+  time it can't find a token)
+- Server URL: `http://127.0.0.1:3070`
+- Token: paste what `npm run token` printed
+- Save
+
+## 4. Try it
+
+- Go to any real article (a blog post, news article, etc.)
+- Click the stash toolbar icon, or right-click the page → **Send to stash**
+- You should get a browser notification confirming the send
+- Visit `http://127.0.0.1:3070/?t=<your-token>` in a tab — you'll see it
+  in the list, click through to the cleaned reader view
+
+## Notes
+
+- **Firefox is a bit different** — use
+  `about:debugging#/runtime/this-firefox` → "Load Temporary Add-on" → pick
+  `manifest.json`. Temporary add-ons vanish on browser restart, so
+  Chrome/Chromium's unpacked-extension loading (which persists) is the
+  easier one to actually live with day to day.
+- **Notifications permission** — Chrome may prompt once to allow
+  notifications from the extension. Allow it, or you just won't get the
+  success/failure toast (capture still works either way).
+- This is all local/loopback for now. Once a server is deployed
+  somewhere reachable, point the extension's Server URL at that instead
+  — nothing else changes.